CN117076267A - Monitoring method and device based on alarm automatic diagnosis, electronic equipment and medium - Google Patents

Abstract

The disclosure provides a monitoring method based on alarm automatic diagnosis, which can be used in the financial field or other fields. The monitoring method comprises the following steps: acquiring a plurality of historical alarm information, classifying the plurality of historical alarm information to form an alarm classification table, wherein each alarm category in the alarm classification table is configured with an executable automatic diagnosis script for processing the alarm information under the alarm category; in response to the occurrence of the real-time alarm information, classifying the real-time alarm information to obtain a real-time alarm category; associating the real-time alarm category with the alarm classification table, matching the corresponding automatic diagnosis script, and executing the corresponding automatic diagnosis script; after the execution of the corresponding automatic diagnosis script is completed, determining whether the real-time alarm information is released or not according to the current state of the real-time alarm information. The disclosure also provides a monitoring device, an electronic device, a storage medium and a program product based on the alarm automatic diagnosis.

Description

Monitoring method and device based on alarm automatic diagnosis, electronic equipment and medium

Technical Field

The present disclosure may be used in the financial field or other fields, and more particularly, to a monitoring method, apparatus, electronic device, storage medium, and program product based on alarm automatic diagnosis.

Background

At present, as application devices increase, the number of server alarms increases dramatically, involving excessive disk usage, involving network interruption, and involving abnormal increases in tables. When the server alarms, operators on duty need to search an operation and maintenance manual, and contact the application to be responsible for operation. In the process, the manual operation is extremely low in efficiency, a great amount of manpower is wasted, misoperation is easy to occur, and risks are increased. Meanwhile, the progress of the problem is not displayed in the monitoring view, and the operator on duty does not know the progress of the problem.

Disclosure of Invention

In view of the foregoing, the present disclosure provides a monitoring method, apparatus, electronic device, storage medium, and program product based on alarm automatic diagnosis.

According to a first aspect of the present disclosure, there is provided a monitoring method based on alarm automatic diagnosis, including: acquiring a plurality of historical alarm information, classifying the plurality of historical alarm information to form an alarm classification table, wherein each alarm category in the alarm classification table is configured with an executable automatic diagnosis script for processing the alarm information under the alarm category; in response to the occurrence of the real-time alarm information, classifying the real-time alarm information to obtain a real-time alarm category; associating the real-time alarm category with the alarm classification table, matching the corresponding automatic diagnosis script, and executing the corresponding automatic diagnosis script; after the execution of the corresponding automatic diagnosis script is completed, determining whether the real-time alarm information is released or not according to the current state of the real-time alarm information.

According to an embodiment of the present disclosure, in response to occurrence of the real-time alert information, classifying the real-time alert information to obtain a real-time alert category includes: deploying an information acquisition tool Agent on a server to be monitored; the Agent reads a configuration document corresponding to the server and acquires real-time alarm information according to the URL address in the configuration document; and carrying out unified feature classification on the real-time alarm information to obtain the real-time alarm category.

According to an embodiment of the present disclosure, associating the real-time alert category with the alert classification table, matching the corresponding automatic diagnostic script, executing the corresponding automatic diagnostic script includes: the alarm classification table carries out classification processing on the real-time alarm categories; matching the corresponding automatic diagnosis script according to the corresponding relation between the alarm category data after the grading processing and the automatic diagnosis script; and running an automatic diagnosis script to process the real-time alarm information.

According to an embodiment of the present disclosure, the monitoring method further includes: configuring a server to be monitored in a monitoring view; the monitoring view establishes long connection with each monitoring node of the server, and monitors the current state of the real-time alarm information and the real-time alarm processing result; the current state of the real-time alarm information and the real-time alarm processing result are recorded in a database of the monitoring view; and calling the data of the database to display the current state of the real-time alarm information and the real-time alarm processing result.

According to an embodiment of the present disclosure, determining that the real-time alert information has been released includes: determining a processing result of the real-time alarm information by utilizing the three-dimensional view of the real-time alarm information displayed in the monitoring view; and determining that the real-time alarm information is released according to the processing result, sending the processing result to an application background, and deleting the real-time alarm information.

According to an embodiment of the present disclosure, displaying a current state of real-time alert information and a real-time alert processing result includes: in the monitoring view, displaying the geographic position, the network level and the emergency degree of the server in a three-dimensional view mode; the geographic position comprises country, province and machine room information; the network layer comprises a storage layer, a network layer, a system layer and an application layer; the degree of urgency includes, in turn, urgency, generality, and weakness.

According to an embodiment of the present disclosure, the real-time alert information includes: the utilization rate of the disk CPU, the network instantaneous interruption alarm and the database connection are too many.

A second aspect of the present disclosure provides a monitoring device based on alarm automatic diagnosis, including: the alarm classification table configuration module is used for classifying a plurality of historical alarm information to form an alarm classification table, and each alarm category in the alarm classification table is configured with an executable automatic diagnosis script for processing the alarm information under the alarm category; the real-time alarm category determining module is used for responding to the occurrence of the real-time alarm information and classifying the real-time alarm information to obtain a real-time alarm category; the automatic diagnosis script execution module is used for associating the real-time alarm category with the alarm classification table, matching the corresponding automatic diagnosis script and executing the corresponding automatic diagnosis script; and the real-time alarm information releasing module is used for determining whether the real-time alarm information is released according to the current state of the real-time alarm information after the execution of the corresponding automatic diagnosis script is completed.

A third aspect of the present disclosure provides an electronic device, comprising: one or more processors; and a storage means for storing one or more programs, wherein the one or more programs, when executed by the one or more processors, cause the one or more processors to perform the above-described alarm-automatic-diagnosis-based monitoring method.

A fourth aspect of the present disclosure also provides a computer-readable storage medium having stored thereon executable instructions that, when executed by a processor, cause the processor to perform the above-described alarm-automatic-diagnosis-based monitoring method.

A fifth aspect of the present disclosure also provides a computer program product comprising a computer program which, when executed by a processor, implements the above-described alarm-based automatic diagnostic monitoring method.

Drawings

The foregoing and other objects, features and advantages of the disclosure will be more apparent from the following description of embodiments of the disclosure with reference to the accompanying drawings, in which:

FIG. 1 schematically illustrates an application scenario diagram of a monitoring method based on alarm autodiagnosis according to an embodiment of the present disclosure;

FIG. 2 schematically illustrates a flow chart of a method of monitoring based on alarm autodiagnosis according to an embodiment of the disclosure;

FIG. 3 schematically illustrates a flow chart of real-time alert information classification according to an embodiment of the present disclosure;

FIG. 4 schematically illustrates a flow chart of real-time alert information processing according to an embodiment of the present disclosure;

FIG. 5 schematically illustrates a flow chart of real-time alert information release according to an embodiment of the present disclosure;

FIG. 6 schematically illustrates a block diagram of a monitoring device based on alarm auto-diagnostics in accordance with an embodiment of the present disclosure;

fig. 7 schematically illustrates a block diagram of an electronic device of a monitoring method based on alarm auto-diagnostics according to an embodiment of the present disclosure.

Detailed Description

Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. It should be understood that the description is only exemplary and is not intended to limit the scope of the present disclosure. In the following detailed description, for purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding of the embodiments of the present disclosure. It may be evident, however, that one or more embodiments may be practiced without these specific details. In addition, in the following description, descriptions of well-known structures and techniques are omitted so as not to unnecessarily obscure the concepts of the present disclosure.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the disclosure. The terms "comprises," "comprising," and/or the like, as used herein, specify the presence of stated features, steps, operations, and/or components, but do not preclude the presence or addition of one or more other features, steps, operations, or components.

All terms (including technical and scientific terms) used herein have the same meaning as commonly understood by one of ordinary skill in the art unless otherwise defined. It should be noted that the terms used herein should be construed to have meanings consistent with the context of the present specification and should not be construed in an idealized or overly formal manner.

Where expressions like at least one of "A, B and C, etc. are used, the expressions should generally be interpreted in accordance with the meaning as commonly understood by those skilled in the art (e.g.," a system having at least one of A, B and C "shall include, but not be limited to, a system having a alone, B alone, C alone, a and B together, a and C together, B and C together, and/or A, B, C together, etc.).

Some of the block diagrams and/or flowchart illustrations are shown in the figures. It will be understood that some blocks of the block diagrams and/or flowchart illustrations, or combinations of blocks in the block diagrams and/or flowchart illustrations, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus, such that the instructions, when executed by the processor, create means for implementing the functions/acts specified in the block diagrams and/or flowchart. The techniques of this disclosure may be implemented in hardware and/or software (including firmware, microcode, etc.). Additionally, the techniques of this disclosure may take the form of a computer program product on a computer-readable storage medium having instructions stored thereon, the computer program product being for use by or in connection with an instruction execution system.

In the technical solution of the present disclosure, the related user information (including, but not limited to, user personal information, user image information, user equipment information, such as location information, etc.) and data (including, but not limited to, data for analysis, stored data, displayed data, etc.) are information and data authorized by the user or sufficiently authorized by each party, and the related data is collected, stored, used, processed, transmitted, provided, disclosed, applied, etc. and processed, all in compliance with the related laws and regulations and standards of the related country and region, necessary security measures are taken, no prejudice to the public order, and corresponding operation entries are provided for the user to select authorization or rejection.

The embodiment of the disclosure provides a monitoring method based on alarm automatic diagnosis, comprising the following steps: acquiring a plurality of historical alarm information, classifying the plurality of historical alarm information to form an alarm classification table, wherein each alarm category in the alarm classification table is configured with an executable automatic diagnosis script for processing the alarm information under the alarm category; in response to the occurrence of the real-time alarm information, classifying the real-time alarm information to obtain a real-time alarm category; associating the real-time alarm category with the alarm classification table, matching the corresponding automatic diagnosis script, and executing the corresponding automatic diagnosis script; after the execution of the corresponding automatic diagnosis script is completed, determining whether the real-time alarm information is released or not according to the current state of the real-time alarm information.

Fig. 1 schematically illustrates an application scenario diagram of a monitoring method based on alarm automatic diagnosis according to an embodiment of the present disclosure. It should be noted that fig. 1 illustrates only an example of an application scenario in which the embodiments of the present disclosure may be applied to help those skilled in the art understand the technical content of the present disclosure, but it does not mean that the embodiments of the present disclosure may not be applied to other devices, systems, environments, or scenarios.

As shown in fig. 1, an application scenario 100 according to this embodiment may include terminal devices 101, 102, 103, a network 104, and a server 105. The network 104 is used as a medium to provide communication links between the terminal devices 101, 102, 103 and the server 105. The network 104 may include various connection types, such as wired, wireless communication links, or fiber optic cables, among others.

The user may interact with the server 105 via the network 104 using the terminal devices 101, 102, 103 to receive or send messages or the like. Various communication client applications, such as shopping class applications, web browser applications, search class applications, instant messaging tools, mailbox clients, social platform software, etc. (by way of example only) may be installed on the terminal devices 101, 102, 103.

The terminal devices 101, 102, 103 may be a variety of electronic devices having a display screen and supporting web browsing, including but not limited to smartphones, tablets, laptop and desktop computers, and the like.

The server 105 may be a server providing various services, such as a background management server (by way of example only) providing support for websites browsed by users using the terminal devices 101, 102, 103. The background management server may analyze and process the received data such as the user request, and feed back the processing result (e.g., the web page, information, or data obtained or generated according to the user request) to the terminal device.

It should be noted that, the monitoring method based on the alarm automatic diagnosis provided by the embodiments of the present disclosure may be generally performed by the server 105. Accordingly, the monitoring device based on alarm automatic diagnosis provided by the embodiments of the present disclosure may be generally provided in the server 105. The monitoring method based on alarm autodiagnosis provided by the embodiments of the present disclosure may also be performed by a server or a server cluster that is different from the server 105 and is capable of communicating with the terminal devices 101, 102, 103 and/or the server 105. Accordingly, the monitoring apparatus based on alarm automatic diagnosis provided by the embodiments of the present disclosure may also be provided in a server or a server cluster different from the server 105 and capable of communicating with the terminal devices 101, 102, 103 and/or the server 105.

It should be understood that the number of terminal devices, networks and servers in fig. 1 is merely illustrative. There may be any number of terminal devices, networks, and servers, as desired for implementation.

The following will describe in detail a monitoring method based on alarm automatic diagnosis of the disclosed embodiment with reference to fig. 2 to 5 based on the scenario described in fig. 1.

Fig. 2 schematically illustrates a flowchart of a monitoring method based on alarm autodiagnosis according to an embodiment of the present disclosure.

In operation S210, a plurality of history alarm information is acquired, the plurality of history alarm information is classified to form an alarm classification table, and each alarm category in the alarm classification table is configured with an executable automatic diagnosis script for processing alarm information under the alarm category.

In response to the occurrence of the real-time alert information, the real-time alert information is classified to obtain a real-time alert category in operation S220.

In operation S230, the real-time alert category is associated with the alert classification table, the corresponding automatic diagnosis script is matched, and the corresponding automatic diagnosis script is executed.

In operation S240, after the execution of the corresponding automatic diagnosis script is completed, it is determined whether the real-time warning information has been released according to the current state of the real-time warning information.

Through the embodiment of the disclosure, the distribution processing of the real-time alarm automatic processing can prevent misoperation of the script, and meanwhile, the rollback script is added, so that faults are prevented from being worsened, more efficient automatic processing is performed, workload of operators on duty is reduced, and manpower input is reduced.

FIG. 3 schematically illustrates a flow chart of real-time alert information classification according to an embodiment of the present disclosure.

As shown in fig. 3, in the embodiment of the present disclosure, operations S321 to S323 may be further included in the above operation S220.

In operation S321, an information collection tool Agent is deployed on a server to be monitored.

In operation S322, the Agent will read the configuration document corresponding to the server, and acquire real-time alarm information according to the URL address in the configuration document.

In operation S323, the real-time alert information is subjected to unified feature classification to obtain a real-time alert category.

Specifically, an acquisition tool Agent is deployed on a key application server, and real-time alarm information is obtained by reading a configuration document corresponding to the server, wherein the real-time alarm information comprises: the utilization rate of the disk CPU, the network instantaneous interruption alarm and the database connection are too many.

By classifying the characteristics of the alarm information, for example, judging that the characteristics of the alarm information are statistical alarm and stream alarm, the statistical alarm is an alarm of the index in a fixed time period, and the alarm judgment is usually carried out regularly; the stream alarm can carry out alarm judgment on each piece of collected monitoring index data, thereby achieving the purpose of real-time alarm. And after the real-time alarm information is subjected to unified feature classification, obtaining the real-time alarm category.

According to the embodiment of the disclosure, the Agent program is utilized to automatically and efficiently acquire the real-time alarm information of the server, and the alarm classification processing is completed.

FIG. 4 schematically illustrates a flow chart of real-time alert information processing according to an embodiment of the present disclosure.

As shown in fig. 4, in the embodiment of the present disclosure, operations S431 to S433 may be further included in the above operation S230.

In operation S431, the alarm classification table classifies the real-time alarm categories.

In operation S432, the corresponding automatic diagnosis script is matched according to the correspondence between the alarm category data and the automatic diagnosis script after the hierarchical processing.

In operation S433, an automatic diagnosis script is run to process the real-time alert information.

Specifically, after a plurality of history alarm information is acquired, the plurality of history alarm information is classified to form an alarm classification table. Each alarm category in the alarm classification table is configured with an executable automatic diagnosis script for processing alarm information under the alarm category.

After the alarm occurs, acquiring real-time alarm information, and after the alarm class is implemented, automatically matching the corresponding automatic diagnosis script through the corresponding relation between the alarm class data in the alarm class table and the automatic diagnosis script, and executing and processing the real-time alarm information according to the diagnosis script.

In this embodiment, there is also a monitoring view machine, where a server to be monitored is configured in the monitoring view, and the monitoring view monitors each layer of application of the server. And the current state of the real-time alarm information and the real-time alarm processing result are displayed in the monitoring view.

Specifically, a server to be monitored is configured in the monitoring view; the monitoring view establishes long connection with each monitoring node of the server, and monitors the current state of the real-time alarm information and the real-time alarm processing result; the current state of the real-time alarm information and the real-time alarm processing result are recorded in a Node table of a database of the monitoring view; and calling the data of the Node table to display the current state of the real-time alarm information and the real-time alarm processing result.

For example, when the server is disconnected (such as down, network disconnection), the established long connection is disconnected, or when the heartbeat data packet is abnormal (no data packet is sent, the data packet interval time is increased), so as to judge whether the server is online and the network quality of the connection; the online state and the running state of the server to be monitored can be judged according to the online state data and the running state data of the server to be monitored through the monitoring view.

According to the embodiment of the disclosure, the real-time alarm information is automatically cured, and the processing procedure of displaying the alarm information is monitored in real time through the three-dimensional view.

FIG. 5 schematically illustrates a flow chart for real-time alert information release according to an embodiment of the present disclosure.

As shown in fig. 5, in the embodiment of the present disclosure, operations S541 to S542 may be further included in the above-described operation S240.

In operation S541, a processing result of the real-time alert information is determined using the three-dimensional view of the real-time alert information displayed in the monitoring view.

In operation S542, it is determined from the processing result that the real-time alert information has been released, the processing result is transmitted to the application background, and the real-time alert information is deleted.

Specifically, real-time alarm information is processed according to the execution of the diagnosis script, a real-time alarm processing result is obtained, and a three-dimensional view is displayed in the monitored view.

For example, the three-dimensional view refers to comprehensive presentation from 3 aspects of the geographic location of the server, the network hierarchy and the alarm emergency. Country, province, machine room information displayed in the geographic location, such as china, shanghai city, jaundice a machine room, B region, and Hua as servers; the alarm network layer displays such as a storage layer, a network layer, a system layer and an application layer; the alarm emergency level in turn indicates emergency, general, weaker.

In this embodiment, whether the alarm processing result has solved the alarm fault is determined through the three-dimensional view, and after determining that the real-time alarm information has been released, the alarm processing result is sent to the background, and the alarm information is deleted. If the alarm fault is not solved, triggering an emergency platform, and manually processing the application responsible person and the application developer.

Through the embodiment of the disclosure, the problem that abnormal alarm occurs is effectively solved, and the processing efficiency between the on-duty personnel and the operation and maintenance personnel and the application responsible person is improved. Aiming at the solution monitoring of abnormal problems, the progress of problem solution is known in time.

Based on the above-mentioned monitoring method, the present disclosure further provides a monitoring device based on alarm automatic diagnosis, which will be described in detail below with reference to fig. 6.

Fig. 6 schematically illustrates a block diagram of a monitoring device based on alarm auto-diagnostics in accordance with an embodiment of the present disclosure.

As shown in fig. 6, the alarm automatic diagnosis-based monitoring apparatus 600 of this embodiment includes an alarm classification table configuration module 610, a real-time alarm category determination module 620, an automatic diagnosis script execution module 630, and a real-time alarm information release module 640.

The alarm classification table configuration module 610 is configured to classify a plurality of historical alarm information to form an alarm classification table, where each alarm class in the alarm classification table is configured with an executable automatic diagnosis script for processing alarm information in the alarm class. In an embodiment, the alarm classification table configuration module 610 may be configured to perform the operation S210 described above, which is not described herein.

The real-time alert category determination module 620 is configured to, in response to occurrence of the real-time alert information, classify the real-time alert information to obtain a real-time alert category. In an embodiment, the real-time alert category determination module 620 may be configured to perform the operation S220 described above, which is not described herein.

The automatic diagnosis script execution module 630 is configured to associate the real-time alarm category with the alarm classification table, match the corresponding automatic diagnosis script, and execute the corresponding automatic diagnosis script. In an embodiment, the automatic diagnosis script execution module 630 may be used to execute the operation S230 described above, which is not described herein.

And the real-time alarm information releasing module 640 is used for determining whether the real-time alarm information is released according to the current state of the real-time alarm information after the execution of the corresponding automatic diagnosis script is completed. In an embodiment, the real-time alert information releasing module 640 may be used to perform the operation S240 described above, which is not described herein.

Any of the alarm classification table configuration module 610, the real-time alarm category determination module 620, the automatic diagnosis script execution module 630, and the real-time alarm information release module 640 may be combined in one module to be implemented, or any of the modules may be split into a plurality of modules, according to an embodiment of the present disclosure. Alternatively, at least some of the functionality of one or more of the modules may be combined with at least some of the functionality of other modules and implemented in one module. According to embodiments of the present disclosure, at least one of the alert classification table configuration module 610, the real-time alert category determination module 620, the automated diagnostic script execution module 630, and the real-time alert information release module 640 may be implemented at least in part as hardware circuitry, such as a Field Programmable Gate Array (FPGA), a Programmable Logic Array (PLA), a system-on-chip, a system-on-substrate, a system-on-package, an Application Specific Integrated Circuit (ASIC), or as hardware or firmware in any other reasonable manner of integrating or packaging the circuitry, or as any one of or a suitable combination of any of the three. Alternatively, at least one of the alarm classification table configuration module 610, the real-time alarm category determination module 620, the automatic diagnosis script execution module 630, and the real-time alarm information release module 640 may be at least partially implemented as a computer program module, which when executed, may perform corresponding functions.

Fig. 7 schematically illustrates a block diagram of an electronic device of a monitoring method based on alarm auto-diagnostics according to an embodiment of the present disclosure.

As shown in fig. 7, an electronic device 700 according to an embodiment of the present disclosure includes a processor 701 that can perform various appropriate actions and processes according to a program stored in a Read Only Memory (ROM) 702 or a program loaded from a storage section 708 into a Random Access Memory (RAM) 703. The processor 701 may include, for example, a general purpose microprocessor (e.g., a CPU), an instruction set processor and/or an associated chipset and/or a special purpose microprocessor (e.g., an Application Specific Integrated Circuit (ASIC)), or the like. The processor 701 may also include on-board memory for caching purposes. The processor 701 may comprise a single processing unit or a plurality of processing units for performing different actions of the method flows according to embodiments of the disclosure.

In the RAM703, various programs and data necessary for the operation of the electronic apparatus 700 are stored. The processor 701, the ROM702, and the RAM703 are connected to each other through a bus 704. The processor 701 performs various operations of the method flow according to the embodiments of the present disclosure by executing programs in the ROM702 and/or the RAM 703. Note that the program may be stored in one or more memories other than the ROM702 and the RAM 703. The processor 701 may also perform various operations of the method flow according to embodiments of the present disclosure by executing programs stored in one or more memories.

According to an embodiment of the present disclosure, the electronic device 700 may further include an input/output (I/O) interface 705, the input/output (I/O) interface 705 also being connected to the bus 704. The electronic device 700 may also include one or more of the following components connected to the I/O interface 705: an input section 706 including a keyboard, a mouse, and the like; an output portion 707 including a Cathode Ray Tube (CRT), a Liquid Crystal Display (LCD), and the like, a speaker, and the like; a storage section 708 including a hard disk or the like; and a communication section 709 including a network interface card such as a LAN card, a modem, or the like. The communication section 709 performs communication processing via a network such as the internet. The drive 710 is also connected to the I/O interface 705 as needed. A removable medium 711 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, or the like is mounted on the drive 710 as necessary, so that a computer program read therefrom is mounted into the storage section 708 as necessary.

The present disclosure also provides a computer-readable storage medium that may be embodied in the apparatus/device/system described in the above embodiments; or may exist alone without being assembled into the apparatus/device/system. The computer-readable storage medium carries one or more programs which, when executed, implement methods in accordance with embodiments of the present disclosure.

According to embodiments of the present disclosure, the computer-readable storage medium may be a non-volatile computer-readable storage medium, which may include, for example, but is not limited to: a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the context of this disclosure, a computer-readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. For example, according to embodiments of the present disclosure, the computer-readable storage medium may include ROM702 and/or RAM703 and/or one or more memories other than ROM702 and RAM703 described above.

Embodiments of the present disclosure also include a computer program product comprising a computer program containing program code for performing the methods shown in the flowcharts. The program code, when executed in a computer system, causes the computer system to perform the methods provided by embodiments of the present disclosure.

The above-described functions defined in the system/apparatus of the embodiments of the present disclosure are performed when the computer program is executed by the processor 701. The systems, apparatus, modules, units, etc. described above may be implemented by computer program modules according to embodiments of the disclosure.

In one embodiment, the computer program may be based on a tangible storage medium such as an optical storage device, a magnetic storage device, or the like. In another embodiment, the computer program may also be transmitted, distributed over a network medium in the form of signals, downloaded and installed via the communication section 709, and/or installed from the removable medium 711. The computer program may include program code that may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the foregoing.

In such an embodiment, the computer program may be downloaded and installed from a network via the communication portion 709, and/or installed from the removable medium 711. The above-described functions defined in the system of the embodiments of the present disclosure are performed when the computer program is executed by the processor 701. The systems, devices, apparatus, modules, units, etc. described above may be implemented by computer program modules according to embodiments of the disclosure.

According to embodiments of the present disclosure, program code for performing computer programs provided by embodiments of the present disclosure may be written in any combination of one or more programming languages, and in particular, such computer programs may be implemented in high-level procedural and/or object-oriented programming languages, and/or assembly/machine languages. Programming languages include, but are not limited to, such as Java, c++, python, "C" or similar programming languages. The program code may execute entirely on the user's computing device, partly on the user's device, partly on a remote computing device, or entirely on the remote computing device or server. In the case of remote computing devices, the remote computing device may be connected to the user computing device through any kind of network, including a Local Area Network (LAN) or a Wide Area Network (WAN), or may be connected to an external computing device (e.g., connected via the Internet using an Internet service provider).

The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams or flowchart illustration, and combinations of blocks in the block diagrams or flowchart illustration, can be implemented by special purpose hardware-based systems which perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.

Those skilled in the art will appreciate that the features recited in the various embodiments of the disclosure and/or in the claims may be provided in a variety of combinations and/or combinations, even if such combinations or combinations are not explicitly recited in the disclosure. In particular, the features recited in the various embodiments of the present disclosure and/or the claims may be variously combined and/or combined without departing from the spirit and teachings of the present disclosure. All such combinations and/or combinations fall within the scope of the present disclosure.

The embodiments of the present disclosure are described above. However, these examples are for illustrative purposes only and are not intended to limit the scope of the present disclosure. Although the embodiments are described above separately, this does not mean that the measures in the embodiments cannot be used advantageously in combination. The scope of the disclosure is defined by the appended claims and equivalents thereof. Various alternatives and modifications can be made by those skilled in the art without departing from the scope of the disclosure, and such alternatives and modifications are intended to fall within the scope of the disclosure.

Claims (11)

1. A monitoring method based on alarm automatic diagnosis comprises the following steps:

acquiring a plurality of historical alarm information, classifying the plurality of historical alarm information to form an alarm classification table, wherein each alarm category in the alarm classification table is configured with an executable automatic diagnosis script for processing alarm information under the alarm category;

in response to the occurrence of the real-time alarm information, classifying the real-time alarm information to obtain a real-time alarm category;

associating the real-time alarm category with the alarm classification table, matching a corresponding automatic diagnosis script, and executing the corresponding automatic diagnosis script;

after the execution of the corresponding automatic diagnosis script is completed, determining whether the real-time alarm information is released or not according to the current state of the real-time alarm information.

2. The method of claim 1, wherein the classifying the real-time alert information into a real-time alert category in response to the occurrence of the real-time alert information comprises:

deploying an information acquisition tool Agent on a server to be monitored;

the Agent reads a configuration document corresponding to the server and acquires the real-time alarm information according to the URL address in the configuration document;

and carrying out unified feature classification on the real-time alarm information to obtain the real-time alarm category.

3. The method of claim 1, wherein associating the real-time alert category with the alert classification table, matching a corresponding automated diagnostic script, executing the corresponding automated diagnostic script comprises:

the alarm classification table carries out classification processing on the real-time alarm categories;

matching the corresponding automatic diagnosis script according to the corresponding relation between the alarm category data after the grading processing and the automatic diagnosis script;

and running the automatic diagnosis script to process the real-time alarm information.

4. The method of claim 1, further comprising:

configuring a server to be monitored in a monitoring view;

the monitoring view establishes long connection with each monitoring node of the server, and monitors the current state of the real-time alarm information and the real-time alarm processing result;

the current state of the real-time alarm information and the real-time alarm processing result are recorded in a database of the monitoring view; and calling the data of the database to display the current state of the real-time alarm information and the real-time alarm processing result.

5. The method of claim 4, determining that the real-time alert information has been dismissed comprising:

determining a processing result of the real-time alarm information by utilizing a three-dimensional view of the real-time alarm information displayed in the monitoring view;

and determining that the real-time alarm information is released according to the processing result, sending the processing result to an application background, and deleting the real-time alarm information.

6. The method of claim 4, wherein the presenting the current status of the real-time alert information and the real-time alert processing results comprises:

in the monitoring view, displaying the geographic position, the network level and the emergency degree of the server in a three-dimensional view mode;

the geographic position comprises country, province and machine room information;

the network layer comprises a storage layer, a network layer, a system layer and an application layer;

the degree of urgency includes, in turn, urgency, generality, and weakness.

7. The method of claim 1, wherein the real-time alert information comprises: the utilization rate of the disk CPU, the network instantaneous interruption alarm and the database connection are too many.

8. A monitoring device based on alarm automatic diagnosis, comprising:

the alarm classification table configuration module is used for classifying a plurality of historical alarm information to form an alarm classification table, and each alarm category in the alarm classification table is configured with an executable automatic diagnosis script for processing the alarm information under the alarm category;

the real-time alarm type determining module is used for responding to the occurrence of the real-time alarm information and classifying the real-time alarm information to obtain a real-time alarm type;

the automatic diagnosis script execution module is used for associating the real-time alarm category with the alarm classification table, matching the corresponding automatic diagnosis script and executing the corresponding automatic diagnosis script;

and the real-time alarm information releasing module is used for determining whether the real-time alarm information is released or not according to the current state of the real-time alarm information after the execution of the corresponding automatic diagnosis script is completed.

9. An electronic device, comprising:

one or more processors;

storage means for storing one or more programs,

wherein the one or more programs, when executed by the one or more processors, cause the one or more processors to perform the method of any of claims 1-7.

10. A computer readable storage medium having stored thereon executable instructions which, when executed by a processor, cause the processor to perform the method according to any of claims 1-7.

11. A computer program product comprising a computer program which, when executed by a processor, implements the method according to any one of claims 1 to 7.